# declaw-ai/mcp-server

**Category:** 👨‍💻 Code Execution  
**Repository:** https://github.com/declaw-ai/mcp-server  
**GitHub Stars:** 1  
**npm Downloads (last month):** 106  
**Views:** 1  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/mcp-server-112

## Description
Secure Firecracker microVM sandboxes for AI agents: network policy, PII & injection guardrails.

## Tools
Capabilities this server exposes over MCP:

- **create_sandbox** — Create a new secure sandbox environment. Returns a sandbox_id to use with other tools.
- **kill_sandbox** — Destroy a sandbox and release its resources.
- **list_sandboxes** — List all active sandboxes for the current API key.
- **run_command** — Execute a shell command inside a sandbox. Returns stdout, stderr, and exit code.
- **read_file** — Read a text file from a sandbox.
- **write_file** — Write text content to a file in a sandbox. Creates parent directories automatically.
- **list_files** — List files and directories at a given path in a sandbox.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "mcp-server": {
    "command": "npx",
    "args": ["-y","@declaw/mcp-server"],
    "env": {
      "DECLAW_API_KEY": "",
      "DECLAW_DOMAIN": ""
    }
  }
}
```

**Requires environment variables:** `DECLAW_API_KEY`, `DECLAW_DOMAIN` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What declaw-ai/mcp-server MCP server does

The declaw-ai/mcp-server MCP server exposes Declaw sandbox operations through MCP. It gives an AI client a way to create an isolated execution environment, run shell commands in that environment, move files into or out of it, inspect directory contents, and clean up the sandbox when work is complete.

The available operations are `create_sandbox`, `run_command`, `read_file`, `write_file`, `list_files`, `kill_sandbox`, and `list_sandboxes`. Sandbox creation accepts configurable security policies. The server is intended for agent workflows that need execution isolation rather than direct access to the host system.

## How it works

An MCP client starts the server with `npx -y @declaw/mcp-server` and supplies a Declaw API key. The client can then use the exposed tools to manage sandbox lifecycles and perform commands or file operations within a selected sandbox.

Security behavior is selected when a sandbox is created. The `none` preset provides no guardrails and allows full internet access. `standard`, the default, enables PII scanning and audit logging while retaining full internet access. `strict` enables PII scanning, prompt-injection defense, audit logging, and a deny-all network policy.

Outbound access can also be narrowed with `allowed_domains`. For example, a strict sandbox can allow selected domains such as `pypi.org` and `github.com` rather than permitting unrestricted network access.

## Setup and configuration

Install the server through an MCP client configuration. Claude Desktop, Cursor, and Windsurf use a configuration entry with `command` set to `npx`, arguments `-y` and `@declaw/mcp-server`, and the API key in the environment. Claude Code can register it with `claude mcp add declaw -- npx -y @declaw/mcp-server`.

`DECLAW_API_KEY` is required. Set `DECLAW_DOMAIN` when connecting to a self-hosted or on-premises Declaw deployment with a custom API domain. The same MCP configuration pattern supports both hosted and on-premises use.

## Tools and capabilities

- Create sandboxes with configurable security policies.
- Execute shell commands inside an existing sandbox.
- Read, write, and list sandbox files.
- List active sandboxes and destroy a sandbox.
- Apply `none`, `standard`, or `strict` security presets.
- Restrict outbound requests with an allowed-domain list.

## Limitations and notes

Network behavior depends on the selected preset and any configured domain allowlist: `none` and `standard` permit full internet access, while `strict` starts with network access denied.

The documented interface covers sandbox management, command execution, and file operations. It does not list a separate MCP tool for snapshots, despite the README mentioning snapshots in a comparison table. Use the documented tools when determining whether the server fits a workflow.

For self-hosted deployments, configure `DECLAW_DOMAIN` with the custom Declaw API domain. The README identifies Apache-2.0 as the project license.

_Full upstream README: https://allmcps.com/mcp/mcp-server-112/readme_